Repository navigation
Security: attach a VEX statement for the musl CVE to Docker Hub images - #555
Merged
Merged
Conversation
Docker Scout reports CVE-2026-107891 against musl 1.2.6-r3, the patched Alpine 3.24 package. The release now attaches an OpenVEX statement to each published platform through Scout's referrer registry, leaving the signed image digest unchanged.
SandObserver
added
github_actions
- Move the attach steps into a vex job after build-and-push, with a 10 minute limit and continue-on-error. No release job waits for it. - Read musl from each platform's published image and attach nothing when it is older than 1.2.6-r3. Name the shipped musl in the statement and stamp the document id and timestamp per release. - Run the Scout CLI from docker/scout-cli pinned by digest, attaching by referrer to each platform's manifest digest. - Make the repository document a template whose product names no real image.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/vex/stackyard.vex.json, an OpenVEX v0.2.0 template marking CVE-2026-107891 asnot_affected(vulnerable_code_not_present): Alpine 3.24 ships the fix in musl 1.2.6-r3, while Docker Scout applies the edge threshold of 1.2.6-r6 (Alpine 3.24 musl 1.2.6-r3 incorrectly matched to CVE-2026-107891 using edge's r6 threshold docker/scout-cli#248). Its product and id are placeholders, so the file names no real image.vexrelease job afterbuild-and-push, only when Docker Hub is configured, with a 10 minute limit andcontinue-on-error. No release job waits for it.docker/scout-clipinned by digest, by referrer to each platform's manifest digest, so the image index, its digest and the cosign signature stay unchanged.Testing
All green. Added 4 tests for the job, the musl check, the Scout pin and the document template; ran the musl check against the 1.19.0 image (refused) and Alpine 3.24.3 (accepted).
Changelog
Security
Checklist